CVE-2026-105765: HashiCorp Consul, заобикаляне на вход и права

Описание

Оригинално описание

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

Засегнати продукти

• HashiCorp Consul: 1.17.0 преди 2.1.0
• HashiCorp Consul Enterprise: 1.17.0 преди 2.1.0

Вид слабост

• CWE-862 Missing Authorization

История

Други уязвимости в HashiCorp Consul

• 6.4CVE-2026-115804
• 7.5CVE-2026-105626
• 8.8CVE-2026-105608
• 7.5CVE-2026-88021
• 5.4CVE-2026-87107

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-105765
• https://nvd.nist.gov/vuln/detail/CVE-2026-105765
• https://discuss.hashicorp.com/t/hcsec-2026-46-consul-vulnerable-to-an-authorization-bypass-in-the-agents-service-mesh-leaf-certificate-api/77911